diff --git a/detections/network/internal_horizontal_port_scan_nmap_top_20.yml b/detections/network/internal_horizontal_port_scan_nmap_top_20.yml
index b2767bfdee..44b2e9546f 100644
--- a/detections/network/internal_horizontal_port_scan_nmap_top_20.yml
+++ b/detections/network/internal_horizontal_port_scan_nmap_top_20.yml
@@ -52,7 +52,7 @@ rba:
   message: $src_ip$ has scanned for ports $dest_ports$ across $totalDestIPCount$ destination
     IPs
   risk_objects:
-  - field: dest_zone
+  - field: dest_ports
     type: system
     score: 72
   threat_objects: